CVE-2024-7203: Zyxel ZLD RCE Vulnerability

CVE-2024-7203 Overview

CVE-2024-7203 is a post-authentication command injection vulnerability affecting Zyxel ATP series and USG FLEX series firewall firmware. The flaw exists in firmware versions from V4.60 through V5.38 on both product lines. An authenticated attacker with administrator privileges can execute arbitrary operating system commands by supplying a crafted command-line interface (CLI) input. The weakness is classified under CWE-78: OS Command Injection.

Critical Impact
An administrator-level attacker can execute arbitrary OS commands on the firewall appliance, undermining the integrity of a perimeter security control.

Affected Products

Zyxel ATP series (ATP100, ATP100W, ATP200, ATP500, ATP700, ATP800) running ZLD firmware V4.60 through V5.38
Zyxel USG FLEX series (USG FLEX 50, 50W, 100, 100AX, 100W, 200, 500, 700) running ZLD firmware V4.60 through V5.38
Zyxel ZLD firmware in the V4.60 – V5.38 range

Discovery Timeline

2024-09-03 - Zyxel publishes security advisory for multiple firewall vulnerabilities
2024-09-03 - CVE-2024-7203 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7203

Vulnerability Analysis

The vulnerability resides in the CLI command-processing logic of Zyxel ZLD firmware. When an authenticated administrator issues a crafted CLI command, the firmware fails to properly neutralize special elements before passing user-controlled input to the underlying operating system shell. This condition permits arbitrary OS command execution in the context of the firewall appliance.

Because exploitation requires valid administrator credentials, the primary abuse scenarios involve credential compromise, insider misuse, or chaining with an authentication weakness. Successful exploitation impacts confidentiality, integrity, and availability of the affected device, since the executed commands run with elevated privileges on the firewall.

Root Cause

The root cause is improper neutralization of special characters used in an OS command [CWE-78]. The CLI handler passes attacker-controlled tokens into a shell context without sufficient input sanitization, allowing metacharacters or command separators to break out of the intended CLI action and invoke arbitrary binaries.

Attack Vector

The attack vector is network-based against the device management interface. The attacker must first authenticate with administrator privileges to reach the vulnerable CLI command. Once authenticated, delivering a crafted CLI string executes commands on the ZLD operating system beneath the CLI abstraction. See the Zyxel Security Advisory for Firewalls for vendor-confirmed technical scope.

// No verified public exploit code is available for CVE-2024-7203.
// The vulnerability is triggered by supplying a crafted CLI command
// containing OS shell metacharacters to an authenticated admin session.

Detection Methods for CVE-2024-7203

Indicators of Compromise

Unexpected administrator logins to the firewall management interface, especially from unusual source IPs or outside business hours
CLI session activity containing shell metacharacters such as ;, |, `, $(), or && inside command arguments
New or modified system processes, cron entries, or outbound connections originating from the firewall itself
Configuration changes to firewall policies, VPN, or administrator accounts that do not correspond to a change ticket

Detection Strategies

Forward device syslog and admin audit logs to a centralized SIEM and alert on CLI commands containing shell control characters
Baseline normal administrator CLI usage and flag deviations, including rarely used commands issued in rapid succession
Correlate administrator authentication events with subsequent configuration or command activity to identify credential misuse

Monitoring Recommendations

Enable verbose CLI and management-plane logging on ZLD devices and retain logs for forensic review
Monitor for firmware versions in the vulnerable range (V4.60 – V5.38) via asset inventory to prioritize remediation
Watch for outbound connections initiated by the firewall to non-management destinations, which may indicate post-exploitation activity

How to Mitigate CVE-2024-7203

Immediate Actions Required

Upgrade affected ATP and USG FLEX devices to the fixed firmware version listed in the Zyxel advisory
Restrict administrative access to trusted management networks only and disable WAN-side management
Rotate administrator credentials and enforce multi-factor authentication for administrative access
Audit administrator accounts and remove unused or shared accounts

Patch Information

Zyxel released fixed firmware for affected ATP and USG FLEX models. Refer to the Zyxel Security Advisory for Firewalls for the specific fixed ZLD versions and download instructions per model. Apply the vendor-supplied firmware update following a tested change-management process.

Workarounds

Limit management-plane exposure using access control lists that permit only known administrator source addresses
Place the firewall management interface behind a jump host or dedicated management VLAN
Reduce the number of accounts with administrator role and apply the principle of least privilege

bash

# Example: restrict HTTPS and SSH management access to a trusted subnet
configure terminal
ip http server table admin rule 1 access-group ADMIN_TRUSTED
ip ssh server rule 1 access-group ADMIN_TRUSTED
write